topic Re: Alerts Against A CSV in Alerting

Alerts Against A CSV

paddy3883 — Mon, 26 Nov 2012 11:04:53 GMT

I have a macro saved which takes 4 parameters and is of the form:

source="MySource" $EventValueFilter$ earliest=$Earliest$ | head _time limit=$Limit$ | stats avg(Timing) as Timing | where Timing >= $Duration$

Which essentially needs to filter events based on a certain attribute for a specified duration, optionally select a sub section of these, calculate the average Timing for that even (Timing is a defined integer value for the events filtered) and return a value when the average is above a certain threshold. Therefore I could call the following:

mymacro(LOGINSTEP, -4h, 0, 100)

which I would want to get the average time for events with LOGINSTEP in their text for the past 4 hrs and detect if this value was >= 100ms. What I would like to do is define a CSV file with a list of potential checks in a similar vein and have 1 alert which iterates over this file and reports on any relevant occurences e.g.

EventValueFilter,Earliest,Limit,Duration LOGINSTEP,-1h,0,100 HOMEPAGE,-1h,5,50 SEARCHRESULTS,-5m,500

I have the lookup file/definition set up and the above macro so I was looking how I can use these two within a Search to alert me?

Re: Alerts Against A CSV

jonuwz — Mon, 26 Nov 2012 13:28:18 GMT

Untested, but 'inputcsv' and 'map' should be what you need

Lets assume your CSV is called alertcheck.csv and the significant field returned by mymacro is 'count'

The search would be along the lines of :

| inputcsv alertcheck.csv 
| map search="
    `mymacro(\"$EventValueFilter$\", \"$Earliest$\", \"$Limit$\", \"$Duration$\")`
    | eval EventValueFilter=\"$EventValueFilter$\"
    | eval Earliest=\"$Earliest$\"
    | eval Limit=\"$Limit$\"
    | eval Duration=\"$Duration$\"
" | table EventValueFilter Earliest Limit Duration count

Re: Alerts Against A CSV

paddy3883 — Mon, 26 Nov 2012 15:46:14 GMT

Thanks for this, I've tried to get it working but something strange happening - when I run this:

I get the following message:

Unable to run query 'mymacro(LOGINSTEP, -1h, 0, 800) | eval EventValueFilter=LOGINSTEP | eval Earliest="-1h" | eval Limit=0 | eval Duration=800'.

However if I run the generated query above directly in a search then I get the results!!

Re: Alerts Against A CSV

jonuwz — Mon, 26 Nov 2012 15:49:30 GMT

oops - need backticks around the macro - updated

Re: Alerts Against A CSV

paddy3883 — Mon, 26 Nov 2012 15:56:40 GMT

Yes, I put those in on my query, and another $ at the end of Duration in the parameter list, still can't understand why I get the message when I run the script, but executing the generated query displays the results?

Re: Alerts Against A CSV

jonuwz — Mon, 26 Nov 2012 16:32:41 GMT

Hmm. Apologies for leading you up the garden path.
This might be a bug.
this has been reported before. macros dont seem to expand in 'map'